As I understand it, the philosophy of splunk is that the underlying data is permanent, so editing the data just isn't part of the mix. You can simulate that by having the search return only the latest similar record. You can also simulate it by deleting any older similar records. My sense of the question, though, is that you are trying to push the river upstream - using splunk for what it is designed to be BAD at, rather than what it is good at. Here are some comments: 1) In essence, splunk will index the data sent to any log it has been told to index. Therefore, you can use any process that will cause a record to be appended to a defined log. It would be smart to separate the menu log events from the feedback log events, since they are likely to need different user validation checks. 2) For menu display, store the data in a lookup table instead of in the underlying events. Allow qualified users (somehow) to send in events setting the price and availability of menu items as/of an effective date, to your menu log, and then periodically calculate the current menu prices for the lookup table. Note - You need "availability" as a distinct field, in order to turn off items that are removed. Using a high dollar value as a flag would limit the ability to reuse and generalize your system in other contexts. Alternately, give the qualified menu-input-users the ability to upload CSV files themselves, and have a periodic process to ingest them into the overall lookup table. ... View more